Design an In-Memory HTTP API for Auth and Profile Management
Context
Design a minimal, single-node, in-memory HTTP API that supports user registration, authentication, profile retrieval/update, and account deletion. Assume no external database; all persistence is lost on server restart. Password hashing can be mocked.
Requirements
- Implement the following RESTful endpoints:
- Register User: Create a new user account using email and password.
- Authenticate (Login): Verify user credentials and issue an authentication token.
- Retrieve Profile: Fetch the profile details of the currently authenticated user.
- Update Profile: Modify the profile details of the currently authenticated user.
- Delete Account: Remove the currently authenticated user's account.
- Provide clear data models and define request/response JSON schemas for all endpoints.
- Include basic input validation and establish consistent error handling conventions across the API.
- Be prepared to discuss design trade-offs and potential extensions, such as session management vs. token-based authentication, password reset flows, and audit logging.
Assumptions
- The server will run as a single process, single instance (no clustering or horizontal scaling).
- Password hashing should be represented by a placeholder function; do not implement real cryptographic operations.
- Access control for profile-related endpoints (retrieve, update, delete) must be enforced using a bearer token obtained during the login process.
- The focus is on delivering a Minimum Viable Product (MVP) suitable for an onsite system design interview.
AI interview prep
Core dilemma
Designing a robust, secure, and extensible API for user management within the severe constraints of single-node, in-memory persistence, forcing a focus on fundamental API design, security, and graceful degradation rather than distributed systems.
3 tradeoffs and 2 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Design an In-Memory HTTP API for Auth and Profile Management
Context
Design a minimal, single-node, in-memory HTTP API that supports user registration, authentication, profile retrieval/update, and account deletion. Assume no external database; all persistence is lost on server restart. Password hashing can be mocked.
Requirements
- Implement the following RESTful endpoints:
- Register User: Create a new user account using email and password.
- Authenticate (Login): Verify user credentials and issue an authentication token.
- Retrieve Profile: Fetch the profile details of the currently authenticated user.
- Update Profile: Modify the profile details of the currently authenticated user.
- Delete Account: Remove the currently authenticated user's account.
- Provide clear data models and define request/response JSON schemas for all endpoints.
- Include basic input validation and establish consistent error handling conventions across the API.
- Be prepared to discuss design trade-offs and potential extensions, such as session management vs. token-based authentication, password reset flows, and audit logging.
Assumptions
- The server will run as a single process, single instance (no clustering or horizontal scaling).
- Password hashing should be represented by a placeholder function; do not implement real cryptographic operations.
- Access control for profile-related endpoints (retrieve, update, delete) must be enforced using a bearer token obtained during the login process.
- The focus is on delivering a Minimum Viable Product (MVP) suitable for an onsite system design interview.